CCNA Key Value Store Questions

The `-recurse` flag makes the get operation return every key sharing the given prefix, including nested paths, along with each key's value, flags, and modify index. This single command satisfies the requirement to enumerate the subtree and inspect metadata for each entry, which is why it is the standard way to audit a KV prefix.

Consul's KV write API defaults the Flags field to 0 when the request omits it. Flags is an opaque 64-bit unsigned integer reserved for client-side use, so Consul stores zero rather than rejecting the write.

Consul's check-and-set parameter makes the write conditional on the key's current ModifyIndex. Supplying cas=0 means the operation succeeds only when the key does not yet exist, since a fresh key has ModifyIndex zero. Any existing key returns a conflict, satisfying the stem's requirement exactly.

The `consul watch` command supports the `keyprefix` watch type, which monitors all keys under a given prefix. When any key under `app/prod/` is added, modified, or deleted, the watch fires and returns the current state of the prefix. This avoids polling and efficiently notifies the team of any change.

The `-cas` flag performs a check-and-set using the supplied ModifyIndex. Passing `812`, the index observed from the prior read or write, tells Consul to apply the new value only if the key's current ModifyIndex still equals 812. If another client changed the key in the meantime, Consul returns HTTP 409 Conflict and the write is rejected, which is exactly the compare-and-swap behavior required here.

Acquire is atomic and succeeds only when the key is unheld or already held by the same session. Binding the key to a session means Consul releases it when the session is invalidated, whether by TTL expiry or a failed health check, giving automatic release on process death.

A very large number of keys inflates the key space that Consul must track, replicate and index across servers, raising memory pressure and Raft log overhead. This directly bottlenecks KV performance, since every write must be consistently replicated to the cluster's followers.

Consul's compare-and-swap is based on the ModifyIndex, not the value. To ensure the value is as expected, the operator must first read the key to check its value and obtain its ModifyIndex, then use `-cas` with that index. If the key changes between the read and the write, the CAS operation fails, preventing race conditions.

A session lock is released when its TTL elapses, so a TTL set too low expires the session prematurely and frees the lock without any explicit release call. This directly satisfies the stem's unexpected-release constraint: Consul's lock is tied to session lifetime, not to client intent.

The Behaviour field controls session invalidation semantics, determining whether locks held by the session are released or remain, directly answering what happens to locks when a session becomes invalid. This governs the release behaviour rather than lock acquisition.

`consul kv delete` removes the specified key from the KV store. Given the exact path, it deletes only that key, which is precisely what the developer needs to stop the application from reading the obsolete timeout value. This is the direct, idiomatic way to remove a single key.

The `-cas` flag performs a check-and-set operation. Passing `-cas=0` tells Consul to only write the key if its current ModifyIndex is 0, which is the case for a key that does not exist. If the key is already present, the write fails with a conflict, achieving the atomic create-if-absent behavior the developer needs.

Supplying the full key path without any recursion flag deletes only that exact entry. Consul treats the argument as a literal key, so sibling keys under `app/temp/` remain intact. This is the precise, least-destructive command for removing one entry while preserving the rest of the prefix.

The `consul kv get` subcommand retrieves the value of a single key from the Consul KV store. It returns the value, and optionally metadata such as flags and CreateIndex/ModifyIndex when using `-detailed`. This directly answers the developer's need to read the current value of `deploy/status` without blocking or watch behavior, making it the correct choice.

The `consul kv get` command retrieves a single key and, by default, returns the value plus metadata fields like CreateIndex, ModifyIndex, LockIndex, Flags, and Session. Because the request targets one exact key path, the response includes that key's metadata without needing any extra flag such as `-detailed`, which is only required for listing operations.

Acquiring a KV key with a session creates a lock. If the session is invalidated—for example, because the node's health check fails—Consul automatically releases the lock and deletes the key. This directly ties the flag's lifetime to the node's health, matching the requirement.

Consul's KV store uses PUT to create or update a key, since the operation is idempotent and supplies the value in the request body. POST is not used for KV writes, satisfying the stem's create-or-update requirement.

The session is kept alive by the Consul agent's renewals. The application's pause does not impact the session because the agent operates independently. The lock remains held until the session is explicitly destroyed or the agent fails to renew. This is a common pitfall in distributed locking with Consul: the lock can outlive the application process.

ModifyIndex is the raft index of the last modification to that key, returned alongside CreateIndex, LockIndex, Key, Flags and Value. It satisfies the stem's requirement by being a field the Consul KV API genuinely includes in its GET response.

The `-recurse` flag makes `consul kv get` walk every key beneath the given prefix and return them all in one response. This lets the team fetch the entire `payments` configuration set with a single call, which is exactly the prefix-retrieval behavior they need for loading structured config at startup.

The `-cas` flag performs a check-and-set operation: the write succeeds only if the key's current ModifyIndex matches the supplied value. Passing 0 asserts that the key does not yet exist, so the first process to write wins and the second receives a failure. This gives the atomic create-if-absent behavior needed to elect a single leader without a race.

A key watch monitors a single KV pair path and fires its handler whenever that key's value changes, matching the requirement to trigger a script on one specific key. Other watch types cover prefixes, services, nodes or checks, not individual key modification.

The consul kv put command writes a key-value pair into the Consul KV store, taking the key path and value as arguments. Other kv subcommands such as get, delete or export read or remove entries, so put is the correct write operation.

Consul KV values are stored as raw byte arrays rather than text-only strings, so arbitrary binary payloads survive intact. This satisfies the stem's requirement, letting operators store certificates, images or serialised blobs directly without encoding them first.

The -recurse flag makes the delete operation walk the key's entire subtree, removing the key and every child beneath it in one command. Without it, Consul deletes only the single key, leaving children orphaned, so this satisfies the requirement to remove the key and all its children.

Consul creates lock sessions through the session endpoint, which returns a session ID used as the lock-delimiter when acquiring KV locks. The /v1/session/create path is the documented API for this, unlike destroy or renew operations.

The check-and-set (`cas`) parameter makes the write succeed only when the key's current `ModifyIndex` equals the supplied value. Reading the key first to capture that index, then writing with `cas`, gives the pipeline an atomic compare-and-swap that fails if another pipeline already changed the value, exactly the guard the blue/green switch requires.

Consul's KV store caps each individual value at 512 KB, a hard limit imposed by the Raft replication and storage layer. Larger payloads must be split across multiple keys or stored externally, so 512 KB is the precise maximum for a single key's value.

A session TTL of 10 seconds is the minimum Consul permits; any lower value is rejected. This satisfies the stem's constraint by matching Consul's documented lower bound for session TTLs, ensuring the lock-delay and health-check timing mechanisms retain meaningful granularity rather than collapsing into effectively immediate expiry.

Consul sessions provide a mechanism for liveness checking. When you create a session with a TTL and use the acquire parameter on a KV PUT, the key is locked to that session. If the session expires due to missed TTL heartbeats, Consul automatically releases the lock, allowing another instance to acquire it. This is the standard way to implement leader election.

The -raw flag prints the value exactly as stored, with no key name, no metadata, and no JSON wrapper. That makes it the correct choice when a script must capture the value verbatim, for example with command substitution into an environment variable.

Consistent forces a leader check for strong consistency.

ACLs with a policy specifying rules for the KV path allow fine-grained control over read and write access. By attaching a token with that policy, you restrict who can read or write the key. This directly satisfies the requirement that only authorized tokens can access the key.

Consul KV watches rely on blocking queries, where the client sends a request with an index and the server holds it open until data changes or the wait timeout expires. This satisfies the stem's requirement for a true statement about watch internals, avoiding polling overhead through long-poll semantics.

The handler field names the external executable Consul invokes when watched KV data changes, satisfying the requirement to trigger a program on updates. Consul runs this process directly, passing change details via environment variables and stdin, rather than performing any in-process callback or HTTP notification.

In Consul, a lock is acquired by associating a session with a key. If the key already has a `Session` field set to an active session, the lock is held. The `-acquire` flag will fail if the lock is already held by a different active session. This is the most likely cause of the error, as it directly reflects the lock semantics.

Deleting a session immediately releases its associated lock, because Consul ties lock lifetime to the session's health rather than to the client holding it. This satisfies the stem's constraint: once the session no longer exists, the lock cannot persist, so waiting contenders acquire it without manual intervention.

The `cas` parameter stands for Check-And-Set, providing optimistic concurrency control for KV writes. Supplying a `cas` value makes the write conditional: Consul compares it against the key's current `ModifyIndex` and only commits if they match, returning an error otherwise. This satisfies the scenario's requirement to prevent overwriting concurrent updates.

The `consul kv delete` command removes the specified key. When given a full key path like `temp/config`, it deletes only that key. It does not affect other keys. This is the precise command for deleting a single key, matching the administrator's requirement.

When a session that holds a lock expires, Consul releases the lock by clearing the Session field and incrementing the LockIndex. This allows other sessions to acquire the lock. The key and its value remain unchanged. This behavior ensures that locks do not become stuck after a session expires.

Supplying the index parameter tells Consul to hold the blocking query open until the KV store's modify index exceeds that value, returning only on change or timeout. This satisfies the stem's requirement to watch for updates based on the last observed index, avoiding repeated polling.

The correct endpoint to read a KV value is GET /v1/kv/ followed by the key path. For the key 'app/config/db_host', the URL is /v1/kv/app/config/db_host. This returns a JSON array containing the key's value, flags, and metadata. It is the standard way to retrieve a single key.

A Consul session binds the lock key to a TTL-backed session, so if the holder fails or stops renewing, the session expires and the lock is released automatically. This prevents deadlocks without manual intervention, satisfying the need for automatic lock release.

Lock acquisition uses the `acquire` operation, passing the candidate's session ID. Consul checks whether the key is currently held by a live session; if not, the write succeeds and records the session ID in the key's Session field. If another valid session holds it, the acquire fails. This is the fundamental mechanism that makes Consul KV locks mutually exclusive.

Consul watches support a `key` type that monitors a single key. The watch uses blocking queries to wait for changes. When the key's value or metadata changes, the watch returns the new data and invokes the configured handler. This is the intended use for reacting to changes in a specific key.

A 403 Forbidden from Consul's KV store signals authorisation failure, not authentication failure. The ACL token presented is valid but its policy grants no matching `key:read` or `key:write` capability for that path. Consul evaluates token policies against the requested KV prefix and denies access when no rule permits it.

The session TTL defines the duration after which an un-renewed session is invalidated, releasing associated locks.

disable_remote_exec only blocks Consul's remote exec functionality, preventing command execution on agents. The KV store is a separate subsystem accessed via its own HTTP API, so this setting leaves key-value operations entirely unaffected, matching the option's no-effect claim.

Consul sessions are invalidated if not renewed within their TTL. If the service fails to renew the session, the lock is released automatically. This is the most likely cause when the service is still running but not properly renewing. Checking renewal activity directly addresses the root cause and is the correct diagnostic step.

The -detailed flag adds CreateIndex, ModifyIndex, LockIndex, Flags, and Session to the output. Inspecting the Session field shows whether a session is attached to the key, and the absence or expiry of that session explains why a lock-holding reader may fail while a plain read succeeds.

The /v1/session/info/:id endpoint returns details for the session matching the supplied ID, satisfying the requirement to retrieve one specific session's information. Other session endpoints create, destroy or list sessions, so they cannot target an individual identifier.

The `-detailed` flag on `consul kv get` prints the key's metadata fields, including `CreateIndex`, `ModifyIndex`, `LockIndex`, `Flags`, and `Session`, in addition to the value. It is the intended CLI way to inspect KV entry metadata without issuing raw HTTP requests, which is precisely what the operator needs here.

Appending `keys=true` to a KV list request returns only key names, omitting values and metadata from the response body. This directly satisfies the stem's payload-reduction constraint, since the default list operation includes values for every key under the prefix, inflating the response unnecessarily.

Consul Watches monitor a specified KV prefix or key for changes and invoke a handler, such as an executable script, when an update occurs. This satisfies the requirement to observe the KV store and run a command in response.

Consul's KV store supports acquire and release operations backed by session-based consensus, letting clients hold a lock key exclusively. This satisfies the distributed locking use case: multiple service instances coordinate leader election or serialised access without an external coordinator.

Sessions are kept alive only by timely renewal; if the client cannot reach the servers to renew within the TTL, the session expires and Consul deletes it, which releases every lock and invalidates every key held by that session. The severed link prevented renewal, so the lock was freed exactly as designed.

This is the correct pattern for leader election. Each candidate creates a session and attempts to acquire a shared key. Only one session can hold the lock at a time. The successful acquirer becomes the leader, and others receive a false response and should retry or wait.